_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T15:55:45.8311138Z'/><EventRecordID>25447</EventRecordID><Correlation/><Execution ProcessID='3488' ThreadID='3148'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-09 15:55:45.827</Data><Data Name='ProcessGuid'>{b5ee82db-2501-6961-be36-000000000800}</Data><Data Name='ProcessId'>5088</Data><Data Name='Image'>C:\Windows\System32\findstr.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Find String (QGREP) Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>FINDSTR.EXE</Data><Data Name='CommandLine'>findstr  /r "LISTENING"</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{b5ee82db-e203-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=7E484985CC835B3892F7445D2692227BA2D2E6F5,MD5=D0A20941751521C0D19BD3EABF34C446,SHA256=940CBEC6750076F2A191CBC8DA96AAE1905F7D9709B48C839BBD52884EFF1A45,IMPHASH=A27641A39DA5A6B0717E06BA00E56B7F</Data><Data Name='ParentProcessGuid'>{b5ee82db-2501-6961-bc36-000000000800}</Data><Data Name='ParentProcessId'>1484</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T15:55:45.8195122Z'/><EventRecordID>25446</EventRecordID><Correlation/><Execution ProcessID='3488' ThreadID='3148'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1049,technique_name=System Network Connections Discovery</Data><Data Name='UtcTime'>2026-01-09 15:55:45.817</Data><Data Name='ProcessGuid'>{b5ee82db-2501-6961-bd36-000000000800}</Data><Data Name='ProcessId'>2720</Data><Data Name='Image'>C:\Windows\System32\NETSTAT.EXE</Data><Data Name='FileVersion'>10.0.20348.3451 (WinBuild.160101.0800)</Data><Data Name='Description'>TCP/IP Netstat Command</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>netstat.exe</Data><Data Name='CommandLine'>netstat  -nao </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{b5ee82db-e203-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2B36D7C03533E8B3DBDEC15DBB173BCB69DB2239,MD5=BDDFB67C57B9C131E5E2927C587A13ED,SHA256=8AD63014D94CF150B19B3AF2E9C5FF5EC19B7ACAFF49D97AFD3AC4C34B9DF4F8,IMPHASH=0621372A264AC3B58A59C2C28375CA74</Data><Data Name='ParentProcessGuid'>{b5ee82db-2501-6961-bc36-000000000800}</Data><Data Name='ParentProcessId'>1484</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>

_sourcetype: XmlWinEventLog

sourcetype: XmlWinEventLog


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T15:55:45.2194484Z'/><EventRecordID>25437</EventRecordID><Correlation/><Execution ProcessID='3488' ThreadID='3148'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1057,technique_name=Process Discovery</Data><Data Name='UtcTime'>2026-01-09 15:55:45.216</Data><Data Name='ProcessGuid'>{b5ee82db-2501-6961-bb36-000000000800}</Data><Data Name='ProcessId'>3840</Data><Data Name='Image'>C:\Windows\System32\tasklist.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Lists the current running tasks</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>tasklist.exe</Data><Data Name='CommandLine'>tasklist  /nh /fo csv</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{b5ee82db-e203-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=A440302FCCCB6D181F8DB017265602397E1EB92A,MD5=2B05A9BDFAEAC5743B47A10F3F0A202B,SHA256=31E6A056EB1E722D8EC8C7E152E6A410B12D6055140BC38FFA1CCBD56AD4E623,IMPHASH=FCEA32ABE79C10DFACC88F5335DD89DE</Data><Data Name='ParentProcessGuid'>{b5ee82db-2501-6961-ba36-000000000800}</Data><Data Name='ParentProcessId'>5624</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c tasklist /nh /fo csv</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T15:55:44.6741757Z'/><EventRecordID>25409</EventRecordID><Correlation/><Execution ProcessID='3488' ThreadID='3148'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-09 15:55:44.660</Data><Data Name='ProcessGuid'>{b5ee82db-2500-6961-b936-000000000800}</Data><Data Name='ProcessId'>4080</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{b5ee82db-e203-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{b5ee82db-2500-6961-b736-000000000800}</Data><Data Name='ParentProcessId'>4800</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T15:55:32.4993365Z'/><EventRecordID>24757</EventRecordID><Correlation/><Execution ProcessID='5908' ThreadID='5696'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-09 15:55:32.496</Data><Data Name='ProcessGuid'>{d79348b5-24f4-6961-6e36-000000000800}</Data><Data Name='ProcessId'>5176</Data><Data Name='Image'>C:\Windows\System32\findstr.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Find String (QGREP) Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>FINDSTR.EXE</Data><Data Name='CommandLine'>findstr  /r "LISTENING"</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{d79348b5-e1c4-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=7E484985CC835B3892F7445D2692227BA2D2E6F5,MD5=D0A20941751521C0D19BD3EABF34C446,SHA256=940CBEC6750076F2A191CBC8DA96AAE1905F7D9709B48C839BBD52884EFF1A45,IMPHASH=A27641A39DA5A6B0717E06BA00E56B7F</Data><Data Name='ParentProcessGuid'>{d79348b5-24f4-6961-6c36-000000000800}</Data><Data Name='ParentProcessId'>4388</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T15:55:32.4919729Z'/><EventRecordID>24756</EventRecordID><Correlation/><Execution ProcessID='5908' ThreadID='5696'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1049,technique_name=System Network Connections Discovery</Data><Data Name='UtcTime'>2026-01-09 15:55:32.489</Data><Data Name='ProcessGuid'>{d79348b5-24f4-6961-6d36-000000000800}</Data><Data Name='ProcessId'>5876</Data><Data Name='Image'>C:\Windows\System32\NETSTAT.EXE</Data><Data Name='FileVersion'>10.0.20348.3451 (WinBuild.160101.0800)</Data><Data Name='Description'>TCP/IP Netstat Command</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>netstat.exe</Data><Data Name='CommandLine'>netstat  -nao </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{d79348b5-e1c4-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2B36D7C03533E8B3DBDEC15DBB173BCB69DB2239,MD5=BDDFB67C57B9C131E5E2927C587A13ED,SHA256=8AD63014D94CF150B19B3AF2E9C5FF5EC19B7ACAFF49D97AFD3AC4C34B9DF4F8,IMPHASH=0621372A264AC3B58A59C2C28375CA74</Data><Data Name='ParentProcessGuid'>{d79348b5-24f4-6961-6c36-000000000800}</Data><Data Name='ParentProcessId'>4388</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T15:55:31.0865972Z'/><EventRecordID>24726</EventRecordID><Correlation/><Execution ProcessID='5908' ThreadID='5696'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1057,technique_name=Process Discovery</Data><Data Name='UtcTime'>2026-01-09 15:55:31.082</Data><Data Name='ProcessGuid'>{d79348b5-24f3-6961-6536-000000000800}</Data><Data Name='ProcessId'>5468</Data><Data Name='Image'>C:\Windows\System32\tasklist.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Lists the current running tasks</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>tasklist.exe</Data><Data Name='CommandLine'>tasklist  /nh /fo csv</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{d79348b5-e1c4-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=A440302FCCCB6D181F8DB017265602397E1EB92A,MD5=2B05A9BDFAEAC5743B47A10F3F0A202B,SHA256=31E6A056EB1E722D8EC8C7E152E6A410B12D6055140BC38FFA1CCBD56AD4E623,IMPHASH=FCEA32ABE79C10DFACC88F5335DD89DE</Data><Data Name='ParentProcessGuid'>{d79348b5-24f3-6961-6436-000000000800}</Data><Data Name='ParentProcessId'>3208</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c tasklist /nh /fo csv</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T15:55:30.4642224Z'/><EventRecordID>24715</EventRecordID><Correlation/><Execution ProcessID='5908' ThreadID='5696'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-09 15:55:30.451</Data><Data Name='ProcessGuid'>{d79348b5-24f2-6961-6236-000000000800}</Data><Data Name='ProcessId'>1848</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{d79348b5-e1c4-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{d79348b5-24f2-6961-6136-000000000800}</Data><Data Name='ParentProcessId'>1752</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T15:54:12.4506412Z'/><EventRecordID>24700</EventRecordID><Correlation/><Execution ProcessID='6020' ThreadID='6136'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-09 15:54:12.446</Data><Data Name='ProcessGuid'>{8c932ff3-24a4-6961-4236-000000000800}</Data><Data Name='ProcessId'>5508</Data><Data Name='Image'>C:\Windows\System32\findstr.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Find String (QGREP) Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>FINDSTR.EXE</Data><Data Name='CommandLine'>findstr  /r "LISTENING"</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{8c932ff3-e182-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=7E484985CC835B3892F7445D2692227BA2D2E6F5,MD5=D0A20941751521C0D19BD3EABF34C446,SHA256=940CBEC6750076F2A191CBC8DA96AAE1905F7D9709B48C839BBD52884EFF1A45,IMPHASH=A27641A39DA5A6B0717E06BA00E56B7F</Data><Data Name='ParentProcessGuid'>{8c932ff3-24a4-6961-4036-000000000800}</Data><Data Name='ParentProcessId'>1672</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T15:54:12.4416801Z'/><EventRecordID>24699</EventRecordID><Correlation/><Execution ProcessID='6020' ThreadID='6136'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1049,technique_name=System Network Connections Discovery</Data><Data Name='UtcTime'>2026-01-09 15:54:12.436</Data><Data Name='ProcessGuid'>{8c932ff3-24a4-6961-4136-000000000800}</Data><Data Name='ProcessId'>5184</Data><Data Name='Image'>C:\Windows\System32\NETSTAT.EXE</Data><Data Name='FileVersion'>10.0.20348.3451 (WinBuild.160101.0800)</Data><Data Name='Description'>TCP/IP Netstat Command</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>netstat.exe</Data><Data Name='CommandLine'>netstat  -nao </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{8c932ff3-e182-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2B36D7C03533E8B3DBDEC15DBB173BCB69DB2239,MD5=BDDFB67C57B9C131E5E2927C587A13ED,SHA256=8AD63014D94CF150B19B3AF2E9C5FF5EC19B7ACAFF49D97AFD3AC4C34B9DF4F8,IMPHASH=0621372A264AC3B58A59C2C28375CA74</Data><Data Name='ParentProcessGuid'>{8c932ff3-24a4-6961-4036-000000000800}</Data><Data Name='ParentProcessId'>1672</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T15:54:11.4259062Z'/><EventRecordID>24673</EventRecordID><Correlation/><Execution ProcessID='6020' ThreadID='6136'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1057,technique_name=Process Discovery</Data><Data Name='UtcTime'>2026-01-09 15:54:11.416</Data><Data Name='ProcessGuid'>{8c932ff3-24a3-6961-3e36-000000000800}</Data><Data Name='ProcessId'>6036</Data><Data Name='Image'>C:\Windows\System32\tasklist.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Lists the current running tasks</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>tasklist.exe</Data><Data Name='CommandLine'>tasklist  /nh /fo csv</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{8c932ff3-e182-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=A440302FCCCB6D181F8DB017265602397E1EB92A,MD5=2B05A9BDFAEAC5743B47A10F3F0A202B,SHA256=31E6A056EB1E722D8EC8C7E152E6A410B12D6055140BC38FFA1CCBD56AD4E623,IMPHASH=FCEA32ABE79C10DFACC88F5335DD89DE</Data><Data Name='ParentProcessGuid'>{8c932ff3-24a3-6961-3d36-000000000800}</Data><Data Name='ParentProcessId'>1172</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c tasklist /nh /fo csv</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T15:54:10.6686201Z'/><EventRecordID>24659</EventRecordID><Correlation/><Execution ProcessID='6020' ThreadID='6136'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-09 15:54:10.658</Data><Data Name='ProcessGuid'>{8c932ff3-24a2-6961-3736-000000000800}</Data><Data Name='ProcessId'>4216</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{8c932ff3-e182-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{8c932ff3-24a2-6961-3636-000000000800}</Data><Data Name='ParentProcessId'>5200</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T15:53:38.1808616Z'/><EventRecordID>25262</EventRecordID><Correlation/><Execution ProcessID='5864' ThreadID='5760'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-09 15:53:38.170</Data><Data Name='ProcessGuid'>{22c61f07-2482-6961-ab36-000000000800}</Data><Data Name='ProcessId'>3024</Data><Data Name='Image'>C:\Windows\System32\findstr.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Find String (QGREP) Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>FINDSTR.EXE</Data><Data Name='CommandLine'>findstr  /r "LISTENING"</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{22c61f07-e16b-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=7E484985CC835B3892F7445D2692227BA2D2E6F5,MD5=D0A20941751521C0D19BD3EABF34C446,SHA256=940CBEC6750076F2A191CBC8DA96AAE1905F7D9709B48C839BBD52884EFF1A45,IMPHASH=A27641A39DA5A6B0717E06BA00E56B7F</Data><Data Name='ParentProcessGuid'>{22c61f07-2482-6961-a936-000000000800}</Data><Data Name='ParentProcessId'>6652</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T15:53:38.1791971Z'/><EventRecordID>25261</EventRecordID><Correlation/><Execution ProcessID='5864' ThreadID='5760'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1049,technique_name=System Network Connections Discovery</Data><Data Name='UtcTime'>2026-01-09 15:53:38.160</Data><Data Name='ProcessGuid'>{22c61f07-2482-6961-aa36-000000000800}</Data><Data Name='ProcessId'>6048</Data><Data Name='Image'>C:\Windows\System32\NETSTAT.EXE</Data><Data Name='FileVersion'>10.0.20348.3451 (WinBuild.160101.0800)</Data><Data Name='Description'>TCP/IP Netstat Command</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>netstat.exe</Data><Data Name='CommandLine'>netstat  -nao </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{22c61f07-e16b-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2B36D7C03533E8B3DBDEC15DBB173BCB69DB2239,MD5=BDDFB67C57B9C131E5E2927C587A13ED,SHA256=8AD63014D94CF150B19B3AF2E9C5FF5EC19B7ACAFF49D97AFD3AC4C34B9DF4F8,IMPHASH=0621372A264AC3B58A59C2C28375CA74</Data><Data Name='ParentProcessGuid'>{22c61f07-2482-6961-a936-000000000800}</Data><Data Name='ParentProcessId'>6652</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T15:53:37.5755915Z'/><EventRecordID>25232</EventRecordID><Correlation/><Execution ProcessID='5864' ThreadID='5760'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1057,technique_name=Process Discovery</Data><Data Name='UtcTime'>2026-01-09 15:53:37.570</Data><Data Name='ProcessGuid'>{22c61f07-2481-6961-a336-000000000800}</Data><Data Name='ProcessId'>456</Data><Data Name='Image'>C:\Windows\System32\tasklist.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Lists the current running tasks</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>tasklist.exe</Data><Data Name='CommandLine'>tasklist  /nh /fo csv</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{22c61f07-e16b-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=A440302FCCCB6D181F8DB017265602397E1EB92A,MD5=2B05A9BDFAEAC5743B47A10F3F0A202B,SHA256=31E6A056EB1E722D8EC8C7E152E6A410B12D6055140BC38FFA1CCBD56AD4E623,IMPHASH=FCEA32ABE79C10DFACC88F5335DD89DE</Data><Data Name='ParentProcessGuid'>{22c61f07-2481-6961-a236-000000000800}</Data><Data Name='ParentProcessId'>6288</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c tasklist /nh /fo csv</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T15:53:36.9602806Z'/><EventRecordID>25221</EventRecordID><Correlation/><Execution ProcessID='5864' ThreadID='5760'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-09 15:53:36.946</Data><Data Name='ProcessGuid'>{22c61f07-2480-6961-a036-000000000800}</Data><Data Name='ProcessId'>6260</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{22c61f07-e16b-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{22c61f07-2480-6961-9f36-000000000800}</Data><Data Name='ParentProcessId'>7024</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T15:53:18.2677354Z'/><EventRecordID>24622</EventRecordID><Correlation/><Execution ProcessID='2288' ThreadID='5448'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-09 15:53:18.265</Data><Data Name='ProcessGuid'>{677db45e-246e-6961-5f36-000000000800}</Data><Data Name='ProcessId'>1108</Data><Data Name='Image'>C:\Windows\System32\findstr.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Find String (QGREP) Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>FINDSTR.EXE</Data><Data Name='CommandLine'>findstr  /r "LISTENING"</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{677db45e-e134-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=7E484985CC835B3892F7445D2692227BA2D2E6F5,MD5=D0A20941751521C0D19BD3EABF34C446,SHA256=940CBEC6750076F2A191CBC8DA96AAE1905F7D9709B48C839BBD52884EFF1A45,IMPHASH=A27641A39DA5A6B0717E06BA00E56B7F</Data><Data Name='ParentProcessGuid'>{677db45e-246e-6961-5d36-000000000800}</Data><Data Name='ParentProcessId'>5196</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T15:53:18.2608082Z'/><EventRecordID>24621</EventRecordID><Correlation/><Execution ProcessID='2288' ThreadID='5448'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1049,technique_name=System Network Connections Discovery</Data><Data Name='UtcTime'>2026-01-09 15:53:18.257</Data><Data Name='ProcessGuid'>{677db45e-246e-6961-5e36-000000000800}</Data><Data Name='ProcessId'>5776</Data><Data Name='Image'>C:\Windows\System32\NETSTAT.EXE</Data><Data Name='FileVersion'>10.0.20348.3451 (WinBuild.160101.0800)</Data><Data Name='Description'>TCP/IP Netstat Command</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>netstat.exe</Data><Data Name='CommandLine'>netstat  -nao </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{677db45e-e134-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2B36D7C03533E8B3DBDEC15DBB173BCB69DB2239,MD5=BDDFB67C57B9C131E5E2927C587A13ED,SHA256=8AD63014D94CF150B19B3AF2E9C5FF5EC19B7ACAFF49D97AFD3AC4C34B9DF4F8,IMPHASH=0621372A264AC3B58A59C2C28375CA74</Data><Data Name='ParentProcessGuid'>{677db45e-246e-6961-5d36-000000000800}</Data><Data Name='ParentProcessId'>5196</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T15:53:16.5681166Z'/><EventRecordID>24562</EventRecordID><Correlation/><Execution ProcessID='2288' ThreadID='5448'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1057,technique_name=Process Discovery</Data><Data Name='UtcTime'>2026-01-09 15:53:16.561</Data><Data Name='ProcessGuid'>{677db45e-246c-6961-5636-000000000800}</Data><Data Name='ProcessId'>3656</Data><Data Name='Image'>C:\Windows\System32\tasklist.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Lists the current running tasks</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>tasklist.exe</Data><Data Name='CommandLine'>tasklist  /nh /fo csv</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{677db45e-e134-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=A440302FCCCB6D181F8DB017265602397E1EB92A,MD5=2B05A9BDFAEAC5743B47A10F3F0A202B,SHA256=31E6A056EB1E722D8EC8C7E152E6A410B12D6055140BC38FFA1CCBD56AD4E623,IMPHASH=FCEA32ABE79C10DFACC88F5335DD89DE</Data><Data Name='ParentProcessGuid'>{677db45e-246c-6961-5536-000000000800}</Data><Data Name='ParentProcessId'>2640</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c tasklist /nh /fo csv</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T15:53:16.0057167Z'/><EventRecordID>24548</EventRecordID><Correlation/><Execution ProcessID='2288' ThreadID='5448'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-09 15:53:15.996</Data><Data Name='ProcessGuid'>{677db45e-246b-6961-5236-000000000800}</Data><Data Name='ProcessId'>5016</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{677db45e-e134-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{677db45e-246b-6961-5136-000000000800}</Data><Data Name='ParentProcessId'>1844</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T15:51:15.7525100Z'/><EventRecordID>24976</EventRecordID><Correlation/><Execution ProcessID='1556' ThreadID='5000'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-09 15:51:15.749</Data><Data Name='ProcessGuid'>{43b9bf8b-23f3-6961-3f36-000000000800}</Data><Data Name='ProcessId'>3280</Data><Data Name='Image'>C:\Windows\System32\findstr.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Find String (QGREP) Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>FINDSTR.EXE</Data><Data Name='CommandLine'>findstr  /r "LISTENING"</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{43b9bf8b-e0e3-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=7E484985CC835B3892F7445D2692227BA2D2E6F5,MD5=D0A20941751521C0D19BD3EABF34C446,SHA256=940CBEC6750076F2A191CBC8DA96AAE1905F7D9709B48C839BBD52884EFF1A45,IMPHASH=A27641A39DA5A6B0717E06BA00E56B7F</Data><Data Name='ParentProcessGuid'>{43b9bf8b-23f3-6961-3d36-000000000800}</Data><Data Name='ParentProcessId'>1456</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T15:51:15.7456319Z'/><EventRecordID>24975</EventRecordID><Correlation/><Execution ProcessID='1556' ThreadID='5000'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1049,technique_name=System Network Connections Discovery</Data><Data Name='UtcTime'>2026-01-09 15:51:15.737</Data><Data Name='ProcessGuid'>{43b9bf8b-23f3-6961-3e36-000000000800}</Data><Data Name='ProcessId'>4188</Data><Data Name='Image'>C:\Windows\System32\NETSTAT.EXE</Data><Data Name='FileVersion'>10.0.20348.3451 (WinBuild.160101.0800)</Data><Data Name='Description'>TCP/IP Netstat Command</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>netstat.exe</Data><Data Name='CommandLine'>netstat  -nao </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{43b9bf8b-e0e3-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2B36D7C03533E8B3DBDEC15DBB173BCB69DB2239,MD5=BDDFB67C57B9C131E5E2927C587A13ED,SHA256=8AD63014D94CF150B19B3AF2E9C5FF5EC19B7ACAFF49D97AFD3AC4C34B9DF4F8,IMPHASH=0621372A264AC3B58A59C2C28375CA74</Data><Data Name='ParentProcessGuid'>{43b9bf8b-23f3-6961-3d36-000000000800}</Data><Data Name='ParentProcessId'>1456</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T15:51:14.3970168Z'/><EventRecordID>24953</EventRecordID><Correlation/><Execution ProcessID='1556' ThreadID='5000'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1057,technique_name=Process Discovery</Data><Data Name='UtcTime'>2026-01-09 15:51:14.385</Data><Data Name='ProcessGuid'>{43b9bf8b-23f2-6961-3b36-000000000800}</Data><Data Name='ProcessId'>5536</Data><Data Name='Image'>C:\Windows\System32\tasklist.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Lists the current running tasks</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>tasklist.exe</Data><Data Name='CommandLine'>tasklist  /nh /fo csv</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{43b9bf8b-e0e3-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=A440302FCCCB6D181F8DB017265602397E1EB92A,MD5=2B05A9BDFAEAC5743B47A10F3F0A202B,SHA256=31E6A056EB1E722D8EC8C7E152E6A410B12D6055140BC38FFA1CCBD56AD4E623,IMPHASH=FCEA32ABE79C10DFACC88F5335DD89DE</Data><Data Name='ParentProcessGuid'>{43b9bf8b-23f2-6961-3a36-000000000800}</Data><Data Name='ParentProcessId'>5276</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c tasklist /nh /fo csv</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T15:51:13.6043865Z'/><EventRecordID>24934</EventRecordID><Correlation/><Execution ProcessID='1556' ThreadID='5000'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-09 15:51:13.591</Data><Data Name='ProcessGuid'>{43b9bf8b-23f1-6961-3436-000000000800}</Data><Data Name='ProcessId'>5584</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{43b9bf8b-e0e3-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{43b9bf8b-23f1-6961-3336-000000000800}</Data><Data Name='ParentProcessId'>4768</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T15:50:48.9109287Z'/><EventRecordID>25046</EventRecordID><Correlation/><Execution ProcessID='5904' ThreadID='5996'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-09 15:50:48.905</Data><Data Name='ProcessGuid'>{cad1564c-23d8-6961-5436-000000000800}</Data><Data Name='ProcessId'>3880</Data><Data Name='Image'>C:\Windows\System32\findstr.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Find String (QGREP) Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>FINDSTR.EXE</Data><Data Name='CommandLine'>findstr  /r "LISTENING"</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{cad1564c-e0a8-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=7E484985CC835B3892F7445D2692227BA2D2E6F5,MD5=D0A20941751521C0D19BD3EABF34C446,SHA256=940CBEC6750076F2A191CBC8DA96AAE1905F7D9709B48C839BBD52884EFF1A45,IMPHASH=A27641A39DA5A6B0717E06BA00E56B7F</Data><Data Name='ParentProcessGuid'>{cad1564c-23d8-6961-5236-000000000800}</Data><Data Name='ParentProcessId'>5980</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T15:50:48.9021057Z'/><EventRecordID>25045</EventRecordID><Correlation/><Execution ProcessID='5904' ThreadID='5996'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1049,technique_name=System Network Connections Discovery</Data><Data Name='UtcTime'>2026-01-09 15:50:48.897</Data><Data Name='ProcessGuid'>{cad1564c-23d8-6961-5336-000000000800}</Data><Data Name='ProcessId'>1664</Data><Data Name='Image'>C:\Windows\System32\NETSTAT.EXE</Data><Data Name='FileVersion'>10.0.20348.3451 (WinBuild.160101.0800)</Data><Data Name='Description'>TCP/IP Netstat Command</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>netstat.exe</Data><Data Name='CommandLine'>netstat  -nao </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{cad1564c-e0a8-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2B36D7C03533E8B3DBDEC15DBB173BCB69DB2239,MD5=BDDFB67C57B9C131E5E2927C587A13ED,SHA256=8AD63014D94CF150B19B3AF2E9C5FF5EC19B7ACAFF49D97AFD3AC4C34B9DF4F8,IMPHASH=0621372A264AC3B58A59C2C28375CA74</Data><Data Name='ParentProcessGuid'>{cad1564c-23d8-6961-5236-000000000800}</Data><Data Name='ParentProcessId'>5980</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T15:50:48.1978896Z'/><EventRecordID>25039</EventRecordID><Correlation/><Execution ProcessID='5904' ThreadID='5996'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1057,technique_name=Process Discovery</Data><Data Name='UtcTime'>2026-01-09 15:50:48.193</Data><Data Name='ProcessGuid'>{cad1564c-23d8-6961-5136-000000000800}</Data><Data Name='ProcessId'>5576</Data><Data Name='Image'>C:\Windows\System32\tasklist.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Lists the current running tasks</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>tasklist.exe</Data><Data Name='CommandLine'>tasklist  /nh /fo csv</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{cad1564c-e0a8-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=A440302FCCCB6D181F8DB017265602397E1EB92A,MD5=2B05A9BDFAEAC5743B47A10F3F0A202B,SHA256=31E6A056EB1E722D8EC8C7E152E6A410B12D6055140BC38FFA1CCBD56AD4E623,IMPHASH=FCEA32ABE79C10DFACC88F5335DD89DE</Data><Data Name='ParentProcessGuid'>{cad1564c-23d8-6961-5036-000000000800}</Data><Data Name='ParentProcessId'>1496</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c tasklist /nh /fo csv</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T15:50:47.7355411Z'/><EventRecordID>25032</EventRecordID><Correlation/><Execution ProcessID='5904' ThreadID='5996'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-09 15:50:47.727</Data><Data Name='ProcessGuid'>{cad1564c-23d7-6961-4f36-000000000800}</Data><Data Name='ProcessId'>4176</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{cad1564c-e0a8-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{cad1564c-23d7-6961-4e36-000000000800}</Data><Data Name='ParentProcessId'>2692</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T15:50:22.1453865Z'/><EventRecordID>34412</EventRecordID><Correlation/><Execution ProcessID='6100' ThreadID='5472'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-09 15:50:22.142</Data><Data Name='ProcessGuid'>{9f12f7c2-23be-6961-a036-000000000800}</Data><Data Name='ProcessId'>2112</Data><Data Name='Image'>C:\Windows\System32\findstr.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Find String (QGREP) Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>FINDSTR.EXE</Data><Data Name='CommandLine'>findstr  /r "LISTENING"</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{9f12f7c2-e0a7-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=7E484985CC835B3892F7445D2692227BA2D2E6F5,MD5=D0A20941751521C0D19BD3EABF34C446,SHA256=940CBEC6750076F2A191CBC8DA96AAE1905F7D9709B48C839BBD52884EFF1A45,IMPHASH=A27641A39DA5A6B0717E06BA00E56B7F</Data><Data Name='ParentProcessGuid'>{9f12f7c2-23be-6961-9e36-000000000800}</Data><Data Name='ParentProcessId'>5292</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T15:50:22.1375849Z'/><EventRecordID>34411</EventRecordID><Correlation/><Execution ProcessID='6100' ThreadID='5472'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1049,technique_name=System Network Connections Discovery</Data><Data Name='UtcTime'>2026-01-09 15:50:22.134</Data><Data Name='ProcessGuid'>{9f12f7c2-23be-6961-9f36-000000000800}</Data><Data Name='ProcessId'>5240</Data><Data Name='Image'>C:\Windows\System32\NETSTAT.EXE</Data><Data Name='FileVersion'>10.0.20348.3451 (WinBuild.160101.0800)</Data><Data Name='Description'>TCP/IP Netstat Command</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>netstat.exe</Data><Data Name='CommandLine'>netstat  -nao </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{9f12f7c2-e0a7-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2B36D7C03533E8B3DBDEC15DBB173BCB69DB2239,MD5=BDDFB67C57B9C131E5E2927C587A13ED,SHA256=8AD63014D94CF150B19B3AF2E9C5FF5EC19B7ACAFF49D97AFD3AC4C34B9DF4F8,IMPHASH=0621372A264AC3B58A59C2C28375CA74</Data><Data Name='ParentProcessGuid'>{9f12f7c2-23be-6961-9e36-000000000800}</Data><Data Name='ParentProcessId'>5292</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T15:50:20.9082367Z'/><EventRecordID>25140</EventRecordID><Correlation/><Execution ProcessID='424' ThreadID='2024'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-09 15:50:20.896</Data><Data Name='ProcessGuid'>{46de3de3-23bc-6961-5136-000000000800}</Data><Data Name='ProcessId'>6400</Data><Data Name='Image'>C:\Windows\System32\findstr.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Find String (QGREP) Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>FINDSTR.EXE</Data><Data Name='CommandLine'>findstr  /r "LISTENING"</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{46de3de3-e0bb-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=7E484985CC835B3892F7445D2692227BA2D2E6F5,MD5=D0A20941751521C0D19BD3EABF34C446,SHA256=940CBEC6750076F2A191CBC8DA96AAE1905F7D9709B48C839BBD52884EFF1A45,IMPHASH=A27641A39DA5A6B0717E06BA00E56B7F</Data><Data Name='ParentProcessGuid'>{46de3de3-23bc-6961-4f36-000000000800}</Data><Data Name='ParentProcessId'>292</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T15:50:20.8915363Z'/><EventRecordID>25139</EventRecordID><Correlation/><Execution ProcessID='424' ThreadID='2024'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1049,technique_name=System Network Connections Discovery</Data><Data Name='UtcTime'>2026-01-09 15:50:20.886</Data><Data Name='ProcessGuid'>{46de3de3-23bc-6961-5036-000000000800}</Data><Data Name='ProcessId'>6324</Data><Data Name='Image'>C:\Windows\System32\NETSTAT.EXE</Data><Data Name='FileVersion'>10.0.20348.3451 (WinBuild.160101.0800)</Data><Data Name='Description'>TCP/IP Netstat Command</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>netstat.exe</Data><Data Name='CommandLine'>netstat  -nao </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{46de3de3-e0bb-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2B36D7C03533E8B3DBDEC15DBB173BCB69DB2239,MD5=BDDFB67C57B9C131E5E2927C587A13ED,SHA256=8AD63014D94CF150B19B3AF2E9C5FF5EC19B7ACAFF49D97AFD3AC4C34B9DF4F8,IMPHASH=0621372A264AC3B58A59C2C28375CA74</Data><Data Name='ParentProcessGuid'>{46de3de3-23bc-6961-4f36-000000000800}</Data><Data Name='ParentProcessId'>292</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T15:50:20.8708544Z'/><EventRecordID>34384</EventRecordID><Correlation/><Execution ProcessID='6100' ThreadID='5472'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1057,technique_name=Process Discovery</Data><Data Name='UtcTime'>2026-01-09 15:50:20.866</Data><Data Name='ProcessGuid'>{9f12f7c2-23bc-6961-9c36-000000000800}</Data><Data Name='ProcessId'>1632</Data><Data Name='Image'>C:\Windows\System32\tasklist.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Lists the current running tasks</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>tasklist.exe</Data><Data Name='CommandLine'>tasklist  /nh /fo csv</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{9f12f7c2-e0a7-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=A440302FCCCB6D181F8DB017265602397E1EB92A,MD5=2B05A9BDFAEAC5743B47A10F3F0A202B,SHA256=31E6A056EB1E722D8EC8C7E152E6A410B12D6055140BC38FFA1CCBD56AD4E623,IMPHASH=FCEA32ABE79C10DFACC88F5335DD89DE</Data><Data Name='ParentProcessGuid'>{9f12f7c2-23bc-6961-9b36-000000000800}</Data><Data Name='ParentProcessId'>3860</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c tasklist /nh /fo csv</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T15:50:20.3898420Z'/><EventRecordID>25116</EventRecordID><Correlation/><Execution ProcessID='424' ThreadID='2024'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1057,technique_name=Process Discovery</Data><Data Name='UtcTime'>2026-01-09 15:50:20.378</Data><Data Name='ProcessGuid'>{46de3de3-23bc-6961-4e36-000000000800}</Data><Data Name='ProcessId'>4996</Data><Data Name='Image'>C:\Windows\System32\tasklist.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Lists the current running tasks</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>tasklist.exe</Data><Data Name='CommandLine'>tasklist  /nh /fo csv</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{46de3de3-e0bb-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=A440302FCCCB6D181F8DB017265602397E1EB92A,MD5=2B05A9BDFAEAC5743B47A10F3F0A202B,SHA256=31E6A056EB1E722D8EC8C7E152E6A410B12D6055140BC38FFA1CCBD56AD4E623,IMPHASH=FCEA32ABE79C10DFACC88F5335DD89DE</Data><Data Name='ParentProcessGuid'>{46de3de3-23bc-6961-4d36-000000000800}</Data><Data Name='ParentProcessId'>6680</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c tasklist /nh /fo csv</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T15:50:20.1859409Z'/><EventRecordID>34365</EventRecordID><Correlation/><Execution ProcessID='6100' ThreadID='5472'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-09 15:50:20.132</Data><Data Name='ProcessGuid'>{9f12f7c2-23bc-6961-9536-000000000800}</Data><Data Name='ProcessId'>3508</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{9f12f7c2-e0a7-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{9f12f7c2-23bc-6961-9436-000000000800}</Data><Data Name='ParentProcessId'>1148</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T15:50:19.5421409Z'/><EventRecordID>25078</EventRecordID><Correlation/><Execution ProcessID='424' ThreadID='2024'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-09 15:50:19.524</Data><Data Name='ProcessGuid'>{46de3de3-23bb-6961-4636-000000000800}</Data><Data Name='ProcessId'>7048</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{46de3de3-e0bb-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{46de3de3-23bb-6961-4536-000000000800}</Data><Data Name='ParentProcessId'>7112</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T15:40:43.0253781Z'/><EventRecordID>25070</EventRecordID><Correlation/><Execution ProcessID='5864' ThreadID='5760'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1086,technique_name=PowerShell</Data><Data Name='UtcTime'>2026-01-09 15:40:42.974</Data><Data Name='ProcessGuid'>{22c61f07-217a-6961-5e36-000000000800}</Data><Data Name='ProcessId'>460</Data><Data Name='Image'>C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>Windows PowerShell</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>PowerShell.EXE</Data><Data Name='CommandLine'>powershell.exe -ExecutionPolicy Restricted -Command $res = 0; if(get-vmswitch | Where {$_.NetAdapterInterfaceDescription -ne $null -and $_.NetAdapterInterfaceDescription -eq (Get-NetLbfoTeamNic).InterfaceDescription}){$res=1}; Write-Host "Final result:", $res</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{22c61f07-e16b-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=3E72BEF25A1CD88C502421E3D50A8EB4C6BD1226,MD5=DD6F4B7818A253887B8EA86515F6FB7D,SHA256=38F4384643B3FA0DE714D2367B712C2E0FA1C89E2CFD131AE6B831AD962B1033,IMPHASH=AFACF6DC9041114B198160AAB4D0AE77</Data><Data Name='ParentProcessGuid'>{22c61f07-2164-6961-5436-000000000800}</Data><Data Name='ParentProcessId'>7160</Data><Data Name='ParentImage'>C:\Windows\System32\CompatTelRunner.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\CompatTelRunner.exe -m:appraiser.dll -f:DoScheduledTelemetryRun -cv:AW953/rI+EuBdhDt.2</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T15:09:51.8589491Z'/><EventRecordID>24869</EventRecordID><Correlation/><Execution ProcessID='6004' ThreadID='5224'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1086,technique_name=PowerShell</Data><Data Name='UtcTime'>2026-01-09 15:09:51.850</Data><Data Name='ProcessGuid'>{d5955fcb-1a3f-6961-ce35-000000000800}</Data><Data Name='ProcessId'>6784</Data><Data Name='Image'>C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>Windows PowerShell</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>PowerShell.EXE</Data><Data Name='CommandLine'>powershell.exe -ExecutionPolicy Restricted -Command $res = 0; if(get-vmswitch | Where {$_.NetAdapterInterfaceDescription -ne $null -and $_.NetAdapterInterfaceDescription -eq (Get-NetLbfoTeamNic).InterfaceDescription}){$res=1}; Write-Host "Final result:", $res</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{d5955fcb-e24e-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=3E72BEF25A1CD88C502421E3D50A8EB4C6BD1226,MD5=DD6F4B7818A253887B8EA86515F6FB7D,SHA256=38F4384643B3FA0DE714D2367B712C2E0FA1C89E2CFD131AE6B831AD962B1033,IMPHASH=AFACF6DC9041114B198160AAB4D0AE77</Data><Data Name='ParentProcessGuid'>{d5955fcb-1a29-6961-c535-000000000800}</Data><Data Name='ParentProcessId'>6412</Data><Data Name='ParentImage'>C:\Windows\System32\CompatTelRunner.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\CompatTelRunner.exe -m:appraiser.dll -f:DoScheduledTelemetryRun -cv:Ej6dpVsW60CZJoSs.2</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T14:57:48.9381302Z'/><EventRecordID>24758</EventRecordID><Correlation/><Execution ProcessID='6004' ThreadID='5224'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-09 14:57:48.933</Data><Data Name='ProcessGuid'>{d5955fcb-176c-6961-9835-000000000800}</Data><Data Name='ProcessId'>7024</Data><Data Name='Image'>C:\Windows\System32\findstr.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Find String (QGREP) Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>FINDSTR.EXE</Data><Data Name='CommandLine'>findstr  /r "LISTENING"</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{d5955fcb-e24e-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=7E484985CC835B3892F7445D2692227BA2D2E6F5,MD5=D0A20941751521C0D19BD3EABF34C446,SHA256=940CBEC6750076F2A191CBC8DA96AAE1905F7D9709B48C839BBD52884EFF1A45,IMPHASH=A27641A39DA5A6B0717E06BA00E56B7F</Data><Data Name='ParentProcessGuid'>{d5955fcb-176c-6961-9635-000000000800}</Data><Data Name='ParentProcessId'>4256</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T14:57:48.9272008Z'/><EventRecordID>24757</EventRecordID><Correlation/><Execution ProcessID='6004' ThreadID='5224'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1049,technique_name=System Network Connections Discovery</Data><Data Name='UtcTime'>2026-01-09 14:57:48.921</Data><Data Name='ProcessGuid'>{d5955fcb-176c-6961-9735-000000000800}</Data><Data Name='ProcessId'>4972</Data><Data Name='Image'>C:\Windows\System32\NETSTAT.EXE</Data><Data Name='FileVersion'>10.0.20348.3451 (WinBuild.160101.0800)</Data><Data Name='Description'>TCP/IP Netstat Command</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>netstat.exe</Data><Data Name='CommandLine'>netstat  -nao </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{d5955fcb-e24e-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2B36D7C03533E8B3DBDEC15DBB173BCB69DB2239,MD5=BDDFB67C57B9C131E5E2927C587A13ED,SHA256=8AD63014D94CF150B19B3AF2E9C5FF5EC19B7ACAFF49D97AFD3AC4C34B9DF4F8,IMPHASH=0621372A264AC3B58A59C2C28375CA74</Data><Data Name='ParentProcessGuid'>{d5955fcb-176c-6961-9635-000000000800}</Data><Data Name='ParentProcessId'>4256</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T14:57:48.2797242Z'/><EventRecordID>24725</EventRecordID><Correlation/><Execution ProcessID='6004' ThreadID='5224'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1057,technique_name=Process Discovery</Data><Data Name='UtcTime'>2026-01-09 14:57:48.270</Data><Data Name='ProcessGuid'>{d5955fcb-176c-6961-9435-000000000800}</Data><Data Name='ProcessId'>6352</Data><Data Name='Image'>C:\Windows\System32\tasklist.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Lists the current running tasks</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>tasklist.exe</Data><Data Name='CommandLine'>tasklist  /nh /fo csv</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{d5955fcb-e24e-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=A440302FCCCB6D181F8DB017265602397E1EB92A,MD5=2B05A9BDFAEAC5743B47A10F3F0A202B,SHA256=31E6A056EB1E722D8EC8C7E152E6A410B12D6055140BC38FFA1CCBD56AD4E623,IMPHASH=FCEA32ABE79C10DFACC88F5335DD89DE</Data><Data Name='ParentProcessGuid'>{d5955fcb-176b-6961-9035-000000000800}</Data><Data Name='ParentProcessId'>7044</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c tasklist /nh /fo csv</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T14:57:47.2205972Z'/><EventRecordID>24686</EventRecordID><Correlation/><Execution ProcessID='6004' ThreadID='5224'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-09 14:57:47.175</Data><Data Name='ProcessGuid'>{d5955fcb-176b-6961-8a35-000000000800}</Data><Data Name='ProcessId'>2952</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{d5955fcb-e24e-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{d5955fcb-176b-6961-8935-000000000800}</Data><Data Name='ParentProcessId'>6660</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T14:57:43.6697526Z'/><EventRecordID>24318</EventRecordID><Correlation/><Execution ProcessID='6056' ThreadID='5380'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-09 14:57:43.666</Data><Data Name='ProcessGuid'>{108affa0-1767-6961-7535-000000000800}</Data><Data Name='ProcessId'>656</Data><Data Name='Image'>C:\Windows\System32\findstr.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Find String (QGREP) Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>FINDSTR.EXE</Data><Data Name='CommandLine'>findstr  /r "LISTENING"</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{108affa0-e249-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=7E484985CC835B3892F7445D2692227BA2D2E6F5,MD5=D0A20941751521C0D19BD3EABF34C446,SHA256=940CBEC6750076F2A191CBC8DA96AAE1905F7D9709B48C839BBD52884EFF1A45,IMPHASH=A27641A39DA5A6B0717E06BA00E56B7F</Data><Data Name='ParentProcessGuid'>{108affa0-1767-6961-7335-000000000800}</Data><Data Name='ParentProcessId'>532</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T14:57:43.6628236Z'/><EventRecordID>24317</EventRecordID><Correlation/><Execution ProcessID='6056' ThreadID='5380'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1049,technique_name=System Network Connections Discovery</Data><Data Name='UtcTime'>2026-01-09 14:57:43.656</Data><Data Name='ProcessGuid'>{108affa0-1767-6961-7435-000000000800}</Data><Data Name='ProcessId'>3756</Data><Data Name='Image'>C:\Windows\System32\NETSTAT.EXE</Data><Data Name='FileVersion'>10.0.20348.3451 (WinBuild.160101.0800)</Data><Data Name='Description'>TCP/IP Netstat Command</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>netstat.exe</Data><Data Name='CommandLine'>netstat  -nao </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{108affa0-e249-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2B36D7C03533E8B3DBDEC15DBB173BCB69DB2239,MD5=BDDFB67C57B9C131E5E2927C587A13ED,SHA256=8AD63014D94CF150B19B3AF2E9C5FF5EC19B7ACAFF49D97AFD3AC4C34B9DF4F8,IMPHASH=0621372A264AC3B58A59C2C28375CA74</Data><Data Name='ParentProcessGuid'>{108affa0-1767-6961-7335-000000000800}</Data><Data Name='ParentProcessId'>532</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T14:57:42.0493950Z'/><EventRecordID>24284</EventRecordID><Correlation/><Execution ProcessID='6056' ThreadID='5380'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1057,technique_name=Process Discovery</Data><Data Name='UtcTime'>2026-01-09 14:57:41.951</Data><Data Name='ProcessGuid'>{108affa0-1765-6961-6f35-000000000800}</Data><Data Name='ProcessId'>1880</Data><Data Name='Image'>C:\Windows\System32\tasklist.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Lists the current running tasks</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>tasklist.exe</Data><Data Name='CommandLine'>tasklist  /nh /fo csv</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{108affa0-e249-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=A440302FCCCB6D181F8DB017265602397E1EB92A,MD5=2B05A9BDFAEAC5743B47A10F3F0A202B,SHA256=31E6A056EB1E722D8EC8C7E152E6A410B12D6055140BC38FFA1CCBD56AD4E623,IMPHASH=FCEA32ABE79C10DFACC88F5335DD89DE</Data><Data Name='ParentProcessGuid'>{108affa0-1765-6961-6d35-000000000800}</Data><Data Name='ParentProcessId'>5928</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c tasklist /nh /fo csv</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T14:57:40.9715526Z'/><EventRecordID>24251</EventRecordID><Correlation/><Execution ProcessID='6056' ThreadID='5380'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-09 14:57:40.961</Data><Data Name='ProcessGuid'>{108affa0-1764-6961-6a35-000000000800}</Data><Data Name='ProcessId'>6064</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{108affa0-e249-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{108affa0-1764-6961-6935-000000000800}</Data><Data Name='ParentProcessId'>5832</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-09T14:56:43.2259524Z'/><EventRecordID>24131</EventRecordID><Correlation/><Execution ProcessID='5540' ThreadID='5704'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-09 14:56:43.222</Data><Data Name='ProcessGuid'>{09708317-172b-6961-5735-000000000800}</Data><Data Name='ProcessId'>5608</Data><Data Name='Image'>C:\Windows\System32\findstr.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Find String (QGREP) Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>FINDSTR.EXE</Data><Data Name='CommandLine'>findstr  /r "LISTENING"</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{09708317-e1f4-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=7E484985CC835B3892F7445D2692227BA2D2E6F5,MD5=D0A20941751521C0D19BD3EABF34C446,SHA256=940CBEC6750076F2A191CBC8DA96AAE1905F7D9709B48C839BBD52884EFF1A45,IMPHASH=A27641A39DA5A6B0717E06BA00E56B7F</Data><Data Name='ParentProcessGuid'>{09708317-172b-6961-5535-000000000800}</Data><Data Name='ParentProcessId'>1036</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>